From trac_osgeo4w at osgeo.org Fri Aug 14 04:20:53 2026 From: trac_osgeo4w at osgeo.org (OSGeo4W) Date: Fri, 14 Aug 2026 11:20:53 -0000 Subject: [osgeo4w-dev] [osgeo4w] #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install Message-ID: <050.f4c3c779f34a56f09dbea5f11f7f0416@osgeo.org> #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install ----------------------+--------------------------- Reporter: ascottwwf | Owner: osgeo4w-dev@? Type: defect | Status: new Priority: normal | Component: Package Version: | Keywords: ----------------------+--------------------------- Hello, I have become aware that our QGIS LTR installations v3.44.13 contain Postgresql v18.4 components (we use the OSGeo4W installer to install / maintain QGIS LTR onto our devices), Postgresql 18.4 contains 24 published Security vulnerabilities (CVEs), a list of these which affect v18.0 and later can be found here: https://www.postgresql.org/support/security/18/ These flaws carry CVSS v3 scores of between 3.8 (Low) and 8.8 (High) The affected files are all found in our default installation folder "C:\Program Files\OSGeo4W_v2\bin" Evidence of the affected files (using Powershell): {{{ cd "C:\Program Files\OSGeo4W_v2\bin\" Get-ChildItem libpq.dll,*pg_*.exe -Recurse -Force -ErrorAction SilentlyContinue | Select-Object * -ExpandProperty versioninfo | Sort- Object ProductVersion,FileVersionRaw,Filename | Select-Object ProductVersion,FileVersionRaw,Filename,FileDescription,CompanyName,LegalCopyright | fl ProductVersion : 18.4 FileVersionRaw : 18.0.4.0 FileName : C:\Program Files\OSGeo4W_v2\bin\libpq.dll FileDescription : PostgreSQL Access Library CompanyName : PostgreSQL Global Development Group LegalCopyright : Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group. Portions Copyright (c) 1994, Regents of the University of California. ProductVersion : 18.4 FileVersionRaw : 18.0.4.0 FileName : C:\Program Files\OSGeo4W_v2\bin\pg_dump.exe FileDescription : pg_dump - backup one PostgreSQL database CompanyName : PostgreSQL Global Development Group LegalCopyright : Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group. Portions Copyright (c) 1994, Regents of the University of California. ProductVersion : 18.4 FileVersionRaw : 18.0.4.0 FileName : C:\Program Files\OSGeo4W_v2\bin\pg_dumpall.exe FileDescription : pg_dumpall - backup PostgreSQL databases CompanyName : PostgreSQL Global Development Group LegalCopyright : Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group. Portions Copyright (c) 1994, Regents of the University of California. ProductVersion : 18.4 FileVersionRaw : 18.0.4.0 FileName : C:\Program Files\OSGeo4W_v2\bin\pg_restore.exe FileDescription : pg_restore - restore PostgreSQL databases CompanyName : PostgreSQL Global Development Group LegalCopyright : Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group. Portions Copyright (c) 1994, Regents of the University of California. }}} Please can I request that the Postgresql components included with OSGeo4W Installer be updated to a later version without impacting / breaking other dependencies (suggest 18.6 - Release Notes: https://www.postgresql.org/docs/release/18.6/) Thanks in advance, Regards,\\ Adrian Scott | EUC Specialist, WWF-UK\\ WWF-UK, The Living Planet Centre, Rufford House,\\ Brewery Road, Woking, Surrey GU21 4LL | wwf.org.uk -- Ticket URL: OSGeo4W OSGeo4W is the Windows installer and package environment for the OSGeo stack. From trac_osgeo4w at osgeo.org Fri Aug 14 04:52:45 2026 From: trac_osgeo4w at osgeo.org (OSGeo4W) Date: Fri, 14 Aug 2026 11:52:45 -0000 Subject: [osgeo4w-dev] [osgeo4w] #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install In-Reply-To: <050.f4c3c779f34a56f09dbea5f11f7f0416@osgeo.org> References: <050.f4c3c779f34a56f09dbea5f11f7f0416@osgeo.org> Message-ID: <065.77d20739be942abf16dc6c0d9bdd269b@osgeo.org> #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install ----------------------+---------------------------- Reporter: ascottwwf | Owner: osgeo4w-dev@? Type: defect | Status: closed Priority: normal | Component: Package Version: | Resolution: fixed Keywords: | ----------------------+---------------------------- Changes (by jef): * resolution: => fixed * status: new => closed -- Ticket URL: OSGeo4W OSGeo4W is the Windows installer and package environment for the OSGeo stack. From trac_osgeo4w at osgeo.org Fri Aug 14 06:13:19 2026 From: trac_osgeo4w at osgeo.org (OSGeo4W) Date: Fri, 14 Aug 2026 13:13:19 -0000 Subject: [osgeo4w-dev] [osgeo4w] #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install In-Reply-To: <050.f4c3c779f34a56f09dbea5f11f7f0416@osgeo.org> References: <050.f4c3c779f34a56f09dbea5f11f7f0416@osgeo.org> Message-ID: <065.1b68b208778d8b7e6bb801b081669109@osgeo.org> #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install ----------------------+---------------------------- Reporter: ascottwwf | Owner: osgeo4w-dev@? Type: defect | Status: closed Priority: normal | Component: Package Version: | Resolution: fixed Keywords: | ----------------------+---------------------------- Comment (by jef): https://github.com/jef-n/OSGeo4W/commit/b2c8c3d27d3061a687e2c006e1bcb656fb9ab64a -- Ticket URL: OSGeo4W OSGeo4W is the Windows installer and package environment for the OSGeo stack.